CVE-2024-5458 Filter bypass in filter_var (FILTER_VALIDATE_URL)

2024-06-0918:26:28

php

github.com

php

versions

code logic

filtering functions

urls

user information

invalid

parsing

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.9

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
    ],
    "vendor": "php",
    "product": "php",
    "versions": [
      {
        "status": "affected",
        "version": "7.3.27",
        "versionType": "semver",
        "lessThanOrEqual": "7.3.33"
      },
      {
        "status": "affected",
        "version": "7.4.15",
        "versionType": "semver",
        "lessThanOrEqual": "7.4.33"
      },
      {
        "status": "affected",
        "version": "8.0.2",
        "versionType": "semver",
        "lessThanOrEqual": "8.0.30"
      },
      {
        "status": "affected",
        "version": "8.1.0",
        "lessThan": "8.1.29",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.2.0",
        "lessThan": "8.2.20",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.3.0",
        "lessThan": "8.3.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*"
    ],
    "vendor": "fedoraproject",
    "product": "fedora",
    "versions": [
      {
        "status": "affected",
        "version": "40"
      }
    ],
    "defaultStatus": "unknown"
  }
]